ghidra-evm

Ghidra EVM Module In the last few years, attacks on deployed smart contracts in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners ha...

ghidra-evm

Módulo Ghidra EVM En los últimos años, los ataques a contratos inteligentes desplegados en la cadena de bloques de Ethereum han resultado en una cantidad significativa de fondos robados debido a errores de programación. Dado que los contratos inteligentes, una vez compilados y desplegados, son...

owasp-scs

OWASP 智能合约安全 SCS 加入 OWASP 智能合约安全 Slack 频道 讨论与支持 这是 OWASP 智能合约安全 SCS 项目的官方 GitHub 仓库。该综合计划为智能合约的开发、审计和验证提供安全标准、指南和资源。SCS 生态系统由多个相互关联的子项目组成，它们相互补充，以促进智能合约、去中心化应用 dApps 和 EVM 区块链系统中的稳健安全实践和合规性。 📚 概述 SCS 项目围绕多个相互关联的资源构建，每个资源在智能合约安全生命周期中都有其独特作用： OWASP 智能合约安全验证标准 SCSVS：...

evm-audit-helpers

evm-audit-helpers Descripción general evm-audit-helpers es una colección seleccionada de fragmentos de Solidity, scripts de Foundry y plantillas de pruebas diseñada para acelerar las auditorías de seguridad de contratos inteligentes en EVM. El repositorio agrupa bloques reutilizables para problem...

efcf-framework

EF/CF - the Extremely Fast ethereum smart Contract Fuzzer EF/CF is a new approach to smart contract fuzzing: instead of using a new custom built fuzzer, it repurposes existing fuzzing infrastructure of C/C++ code to smart contracts. Currently, AFL++ is the primarily supported fuzzer, although the...

manticore

⚠️ Project is archived ⚠️ This project is no longer internally developed and maintained. Manticore Manticore is a symbolic execution tool for the analysis of smart contracts and binaries. Features Program Exploration : Manticore can execute a program with symbolic inputs and explore all the...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

GHSA-7G4W-CG88-2CQ2

creationtimestamp| type| source ---|---|--- 2026-08-28 20:59:24+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mu6ax42wfx2g 2026-08-28 22:00:41+00:00| seen| https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 2026-08-29 01:00:36+00:00| seen|...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: ti: j721e-evm: Fixed a refcount leak in j721esocprobe. where ofparsephandle returns a node pointer with a refcount incremented. We should use ofnodeput on it when it is no longer needed. Added ofnodeput to avoid the refcoun...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ima: Fixed a potential integer overflow in imaappraisemeasurement. When ima-modsig is enabled, the rc parameter passed to evmverifyxattr may be negative, which could lead to an integer overflow issue...

EEF-CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Summary Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-2...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-67581

ZenHive mpp (Elixir HTTP 402 payment library) versions 0.3.0 through before 0.6.3 contain an authentication bypass by capture-replay in the EVM payment method. The function MPP.Methods.EVM.verify/2 matches a transfer solely on token, recipient, and amount without binding the proof to the specific...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

EUVD-2026-62591

Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...

CVE-2026-74399

A flaw was found in the Linux kernel's Extended Verification Module EVM. The evmreadxattrs function, when processing extended attributes, fails to properly initialize a buffer. This can lead to an out-of-bounds read when no extended attributes are configured, potentially allowing an attacker to...

Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...